Nginx ("engine x") 是一个高性能的 HTTP 和反向代理服务器，也是一个 IMAP/POP3/SMTP服务器Nginx是一款轻量级的Web 服务器/反向代理服务器及电子邮件（IMAP/POP3）代理服务器，并在一个BSD-like 协议下发行，其特点是占有内存少，并发能力强，事实上nginx的并发能力确实在同类型的网页服务器中表现较好，其将源代码以类BSD许可证的形式发布，因它的稳定性、丰富的功能集、示例配置文件和低系统资源的消耗而闻名
Nginx作为负载均衡服务器：Nginx既可以在内部直接支持 Rails 和 PHP 程序对外进行服务，也可以支持作为 HTTP代理服务器对外进行服务。Nginx采用C进行编写，不论是系统资源开销还是CPU使用效率都比 Perlbal 要好很多。
简单案例配置
环境centos6.5 32位
nginx-1.9.4.tar.gz
安装
[[email protected] ~]# yum --disablerepo=\* --enablerepo=c6-media groupinstall "Development tools" -y [[email protected] ~]# tar -zxvf nginx-1.9.4.tar.gz -C /usr/local/src/ [[email protected] ~]# cd /usr/local/src/nginx-1.9.4/ [[email protected] nginx-1.9.4]# yum --disablerepo=\* --enablerepo=c6-media install openssl-devel pcre-devel -y [[email protected] nginx-1.9.4]# ./configure > --prefix=/usr/local/nginx > --conf-path=/etc/nginx/nginx.conf > --error-log-path=/var/log/nginx/error.log > --http-log-path=/var/log/nginx/access.log > --pid-path=/var/run/nginx/nginx.pid > --lock-path=/var/lock/nginx.lock > --user=nginx > --group=nginx > --with-http_ssl_module > --with-http_flv_module > --with-http_stub_status_module > --with-http_gzip_static_module > --http-client-body-temp-path=/var/tmp/nginx/client/ > --http-proxy-temp-path=/var/tmp/nginx/proxy/ > --http-fastcgi-temp-path=/var/tmp/nginx/fcgi/ > --with-pcre [[email protected] nginx-1.9.4]# groupadd nginx [[email protected] nginx-1.9.4]# useradd -r -g nginx nginx [[email protected] nginx-1.9.4]# make && make install 启动 /usr/local/nginx/sbin [[email protected] sbin]# nginx [[email protected] sbin]# nginx –s reload
虚拟主机：
1.物理目录
2.虚拟目录
3.基于主机头和基于IP地址
4.身份验证
产生账号库
[[email protected] html]# htpasswd /usr/local/nginx/html/.htpasswd user1
5.来源控制
Ssl
[[email protected] ~]# cd /etc/pki/CA/ [[email protected] CA]# touch index.txt [[email protected] CA]# touch serial [[email protected] CA]# echo "01" >serial [[email protected] CA]# cd .. [[email protected] pki]# cd tls/ [[email protected] tls]# vim openssl.cnf drwxr-xr-x. 5 root root 4096 Aug 27 17:02 . drwxr-xr-x. 9 root root 4096 Jul 7 03:38 .. -rw-r--r--. 1 root root 16384 Aug 27 11:31 .openssl.cnf.swp lrwxrwxrwx. 1 root root 19 Jul 7 03:37 cert.pem -> certs/ca-bundle.crt drwxr-xr-x. 2 root root 4096 Jul 7 03:38 certs drwxr-xr-x. 2 root root 4096 Jul 7 03:38 misc -rw-r--r--. 1 root root 10906 Sep 27 2013 openssl.cnf drwxr-xr-x. 2 root root 4096 Nov 22 2013 private [[email protected] tls]# rm .openssl.cnf.swp rm: remove regular file `.openssl.cnf.swp‘? y [[email protected] tls]# vim openssl.cnf [[email protected] tls]# pwd /etc/pki/tls [[email protected] tls]# cd.. -bash: cd..: command not found [[email protected] tls]# cd .. [[email protected] pki]# openssl genrsa 1024 >CA/private/cakey.pem Generating RSA private key, 1024 bit long modulus .................................++++++ ......................++++++ e is 65537 (0x10001) [[email protected] pki]# chmod 600 CA/private/cakey.pem [[email protected] pki]# cd CA/ [[email protected] CA]# openssl req -new -key private/cakey.pem -x509 -out cacert.pem You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ‘.‘, the field will be left blank. ----- Country Name (2 letter code) [CN]:CN State or Province Name (full name) []:BINGJING Locality Name (eg, city) [BINGJING]:BINGJING Organization Name (eg, company) [Default Company Ltd]:ABC Organizational Unit Name (eg, section) []:COM Common Name (eg, your name or your server‘s hostname) []:WWW Email Address []: [[email protected] CA]# mkdir /etc/nginx/certs [[email protected] CA]# cd /etc/nginx/certs/ [[email protected] certs]# openssl genrsa 1024 >nginx.key Generating RSA private key, 1024 bit long modulus ......................++++++ ...................................................++++++ e is 65537 (0x10001) [[email protected] certs]# chmod 600 nginx.key [[email protected] certs]# ll total 4 -rw-------. 1 root root 887 Aug 27 17:18 nginx.key [[email protected] certs]# openssl req -new -key nginx.key -out nginx.req You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ‘.‘, the field will be left blank. ----- Country Name (2 letter code) [CN]:CN State or Province Name (full name) []:QWE Locality Name (eg, city) [BINGJING]:BINGJING Organization Name (eg, company) [Default Company Ltd]:YYY Organizational Unit Name (eg, section) []:JJJ Common Name (eg, your name or your server‘s hostname) []:KKK Email Address []: Please enter the following ‘extra‘ attributes to be sent with your certificate request A challenge password []: An optional company name []: [[email protected] certs]# [[email protected] certs]# openssl ca -in nginx.req -out nginx.crt Using configuration from /etc/pki/tls/openssl.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Aug 27 09:22:16 2015 GMT Not After : Aug 26 09:22:16 2016 GMT Subject: countryName = CN stateOrProvinceName = QWE organizationName = YYY organizationalUnitName = JJJ commonName = KKK X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: B4:81:50:C7:73:97:8A:92:01:0E:AA:C6:EA:A4:50:B6:C1:9C:5E:6A X509v3 Authority Key Identifier: keyid:F5:9A:5E:BD:11:08:96:4B:46:85:E6:74:5F:72:96:10:18:88:21:EA Certificate is to be certified until Aug 26 09:22:16 2016 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated [[email protected] certs]# cd /etc/nginx/nginx.conf -bash: cd: /etc/nginx/nginx.conf: Not a directory [[email protected] certs]# vim /etc/nginx/nginx.conf [[email protected] certs]# cd /usr/local/nginx/sbin/ [[email protected] sbin]# ./nginx -s reload nginx: [emerg] unknown directive "HTTPS" in /etc/nginx/nginx.conf:166 [[email protected] sbin]# vim /etc/nginx/nginx.conf [[email protected] sbin]# ./nginx -s reload [[email protected] sbin]# cd /etc/pki/ [[email protected] pki]# ll total 28 drwxr-xr-x. 6 root root 4096 Aug 27 17:22 CA drwxr-xr-x. 4 root root 4096 Jul 7 03:37 ca-trust drwxr-xr-x. 2 root root 4096 Jul 7 03:37 java drwxr-xr-x. 2 root root 4096 Jul 7 03:37 nssdb drwxr-xr-x. 2 root root 4096 Jul 7 03:36 rpm-gpg drwx------. 2 root root 4096 Nov 22 2013 rsyslog drwxr-xr-x. 5 root root 4096 Aug 27 17:08 tls [[email protected] pki]# cd CA/ [[email protected] CA]# ll total 36 -rw-r--r--. 1 root root 940 Aug 27 17:16 cacert.pem drwxr-xr-x. 2 root root 4096 Nov 22 2013 certs drwxr-xr-x. 2 root root 4096 Nov 22 2013 crl -rw-r--r--. 1 root root 61 Aug 27 17:22 index.txt -rw-r--r--. 1 root root 21 Aug 27 17:22 index.txt.attr -rw-r--r--. 1 root root 0 Aug 27 17:01 index.txt.old drwxr-xr-x. 2 root root 4096 Aug 27 17:22 newcerts drwx------. 2 root root 4096 Aug 27 17:13 private -rw-r--r--. 1 root root 3 Aug 27 17:22 serial -rw-r--r--. 1 root root 3 Aug 27 17:02 serial.old [[email protected] CA]# cd private/ [[email protected] private]# ll total 4 -rw-------. 1 root root 887 Aug 27 17:13 cakey.pem [[email protected] private]# cp cakey.pem /etc/nginx/certs/ [[email protected] private]# cd /etc/nginx/certs/ [[email protected] certs]# ll total 16 -rw-------. 1 root root 887 Aug 27 17:58 cakey.pem -rw-r--r--. 1 root root 3004 Aug 27 17:22 nginx.crt -rw-------. 1 root root 887 Aug 27 17:18 nginx.key -rw-r--r--. 1 root root 631 Aug 27 17:21 nginx.req [[email protected] certs]# cp nginx.crt nginx.crt.bak [[email protected] certs]# cat nginx.crt cakey.pem >nginx.crt cat: nginx.crt: input file is output file [[email protected] certs]# vim nginx.crt [[email protected] certs]# mv nginx.crt ni [[email protected] certs]# ll total 20 -rw-------. 1 root root 887 Aug 27 17:58 cakey.pem -rw-r--r--. 1 root root 3004 Aug 27 18:00 nginx.crt.bak -rw-------. 1 root root 887 Aug 27 17:18 nginx.key -rw-r--r--. 1 root root 631 Aug 27 17:21 nginx.req -rw-r--r--. 1 root root 887 Aug 27 18:00 ni [[email protected] certs]# cat nginx.crt.bak cakey.pem >nginx.crt [[email protected] certs]# vim nginx.crt [[email protected] certs]# cd /usr/local/nginx/sbin/ [[email protected] sbin]# ./nginx -s reload
时间： 2024-11-07 16:27:36